Version of 15 October 2026
Version: cookies-2026-10-15 · English translation — the French version prevails.
Cookies and storage in your browser
Updated: 15 October 2026.
In short: Bond uses no audience-measurement, advertising or social-network cookies, and no tool that follows you from one site to another. The only things stored in your browser are there to make what you ask for work (your portrait in progress, your sign-in, your language, payment, protection against bots). Bond's cookies are strictly necessary and exempt from consent: that is why no banner asks you to accept cookies on the website. This page tells you about everything that is used.
Cookies set by Bond
| Name | What it is for | Lifetime |
|---|---|---|
bond_guest | Links your browser to the portrait you are preparing without an account. It holds a random identifier; Bond keeps only a fingerprint of it. | 30 days |
Sign-in session cookie (technical name better-auth.session_token, prefixed __Secure- on the secure site) | Keeps you signed in to your Bond space after you sign in or use the link sent by email. | 7 days, extended when you come back to the site |
bond-locale | Remembers the website language (French or English). It is created on your first visit from your browser's language, then changed if you switch language. | 12 months |
These cookies are "strictly necessary": without them the website cannot keep your portrait in progress, your sign-in or your language. The first two cannot be read by the page's scripts (HttpOnly cookies).
Browser session storage
While the tab is open, the website keeps a little technical information in the browser's session storage (sessionStorage), erased when the tab is closed. It contains neither your name, nor your email address, nor your photos: only technical identifiers and flags.
| Key | What it is for |
|---|---|
bond:commission:… | Avoids creating the same portrait twice after a double click. |
bond:seen:… | Shows the "your portrait was waiting for you" message only once. |
bond:preset:… | Remembers the home-page example you clicked, to pre-select it. |
bond:start-intent | Checks that a portrait is created only after your click on "Start" (read once, ignored after two minutes). |
Bond uses neither localStorage nor IndexedDB.
Third-party services, loaded only where they are needed
| Service | Where | Why | What it stores |
|---|---|---|---|
| Stripe (payment) | Only on the payment page | Secure card entry | The card form is provided by Stripe in a secure frame. Bond turns off Stripe.js "advanced fraud signals": Stripe does not set its fraud-prevention cookies (__stripe_mid, __stripe_sid) on bondatelier.eu. Stripe screens every payment on its side, from the payment data itself. While the card is entered, Stripe may load a bot check (hCaptcha), which sets a technical security cookie, __cf_bm (30 minutes), on its own domain (hcaptcha.com). See Stripe's cookie policy. |
| Cloudflare Turnstile (bot check) | Only in the free-sitting request form and on the expired-link page | To check that a person, not a bot, is asking for a free sitting, only to protect the service | Cloudflare's script analyses technical signals from the request and the browser (IP address, connection fingerprint, browser type) and produces a one-time token; according to Cloudflare, it sets no cookie in this mode. Cloudflare also uses these signals, on its own behalf, to improve its bot detection. Bond keeps only the result (passed or not). |
These two services are loaded only when you take the step concerned (paying, asking for your free sitting); Bond does not use them for advertising or audience measurement.
What we do not use
- No audience-measurement tool (Google Analytics or similar), no advertising or social-network pixel (Meta, TikTok…), no session recording, no chat tool.
- Fonts are hosted by Bond: no request is sent to Google Fonts.
- Our emails contain no open-tracking pixel.
- The "See it on my wall" feature on the home page processes the photo of your wall only in your browser: it is neither sent nor stored.
If we ever added a tool that requires consent, we would ask for your agreement before turning it on, with "Accept" and "Refuse" choices equally simple.
How to erase them
You can delete the website's cookies and storage in your browser settings. You will then be signed out, the website will go back to your browser's language, and a portrait started without an account will no longer be linked to your browser (if it is linked to your email address, you find it again by signing back in).
Questions: [email protected].